Do I need Cyber Essentials to bid for public contracts?

For certain central government contracts, such as those involving citizens' personal data or systems handling OFFICIAL information, yes, or equivalent controls. Check the tender documents.

What is the difference between Cyber Essentials and Plus?

The basic level is a verified self-assessment. Plus adds hands-on technical testing of your systems by the certification body.

Are staff phones in scope?

If they access your organisation's data or services, such as work email, they generally need to be included.

How much does certification cost?

Government guidance gives an expected range for smaller companies at the basic level, shown on this page. Plus costs depend on the size and complexity of your network.

Cyber Essentials and public sector contracts

Q: What are the five Cyber Essentials controls?

Firewalls, secure configuration, security update management, user access control and malware protection.

In short

Many small firms first hear of Cyber Essentials when a tender or a client's supplier questionnaire asks for the certificate number. The government requires suppliers bidding for certain public contracts to hold Cyber Essentials or Cyber Essentials Plus, and a growing number of private buyers ask for it too. This guide explains which contracts are affected, what the scheme checks, the difference between the two levels and how to prepare without overspending.

What Cyber Essentials is

Cyber Essentials is the minimum standard of cyber security recommended by the government for organisations of all sizes. It was developed by the National Cyber Security Centre and is built around five technical controls intended to stop the most common internet-based attacks: firewalls, secure configuration, security update management, user access control and malware protection.

IASME is the NCSC's official delivery partner and manages a network of certification bodies across the UK. There are two routes to certification, and certificates have to be renewed regularly to remain valid.

Source: ncsc.gov.uk

Which public contracts require it

Procurement Policy Note 014 sets out the rules for central government and other in-scope public bodies. For contracts with certain characteristics, suppliers must meet technical requirements, and the quickest way to do so is Cyber Essentials or Cyber Essentials Plus, or demonstrating equivalent controls. The characteristics include contracts where a supplier handles citizens' personal information such as home addresses, bank details or payment information; where it handles personal information of government staff, ministers or advisers; where ICT systems store or process data at the OFFICIAL classification level; and where contracts deal with information on the day-to-day business of government and public finances.

PPN 014 applies to procurements under the Procurement Act 2023 from 24 February 2025; earlier procurements follow the previous note. Local authorities and other bodies may apply their own requirements, and many ask for Cyber Essentials in any case.

Source: gov.uk

Cyber Essentials and Cyber Essentials Plus

The basic level is a verified self-assessment: you answer a question set about your IT, and a certification body assesses the answers. Cyber Essentials Plus adds hands-on technical testing of your systems by the certification body. Some contracts specify Plus; others accept either.

The NCSC publishes the question set and the requirements for IT infrastructure in advance, offers a readiness tool that produces an action plan for your organisation, and for small and medium-sized businesses a free short consultation with an NCSC-assured adviser.

Source: ncsc.gov.uk

Scope: the part that trips people up

Most failures come from scope rather than technology. You have to decide which devices, networks and cloud services are covered, and include everything that can access your organisation's data: staff laptops and phones used for work email, home routers where people work remotely, and cloud services such as email and file storage. Unsupported operating systems and software that no longer receives security updates generally have to be removed or isolated.

An IT provider that knows the scheme can help with the scope, patching, account settings and evidence. Agree in advance whether it will also make the changes it finds necessary, or only report them.

Treat certification as a snapshot. The controls only protect you if they stay in place between renewals: new laptops configured the same way, leavers' accounts closed promptly, updates applied as they are released. Buyers increasingly ask not just for the certificate but for how you keep it current.

an inventory of devices, including personal devices used for work
operating systems and software still receiving security updates
administrator accounts separated from everyday accounts
multi-factor authentication on cloud services
firewall and router settings changed from defaults

Getting certified

Prepare with the free question set and readiness tool, fix what they reveal, and then choose a certification body. For contracts that require Plus, schedule the technical testing with enough time before the tender deadline to correct anything that fails. Keep the certificate number handy: buyers can check it.

If you would like help from an IT security firm, describe your business and what you need in our request form. It goes to exactly one security provider that buys it; we email you its name, address and phone number before it sees your details. The service is free for you. Offrano does not check accreditations, so ask the firm which schemes it is licensed for.